IAM Departures Remediation

Automated IAM cleanup for departed employees with rehire-safe logic, change-driven exports, and an AWS-native EventBridge -> Step Function -> 2-Lambda remediation pipeline.

Read reference.md for detailed architecture, framework mappings, IAM role ARN definitions, and security model. Read examples.md for deployment walkthroughs and usage scenarios.

When to Use

• An employee is terminated and their AWS IAM user should be cleaned up
• Bulk offboarding after a layoff or reorganization
• Audit identifies stale IAM users tied to departed employees
• Compliance requires automated deprovisioning (SOC 2 CC6.3, CIS 5.3, NIST PR.AC-1)
• Security team wants to eliminate T1078.004 (Valid Accounts: Cloud Accounts) risk

Pipeline Overview